1

Consider the following piece of code:

.text:00F74B42 call    sub_12D1130
.text:00F74B47 mov     eax, dword_15A0C80

Now, I want to add a sanity check but as I don't have enough space to do that I remove "useless" call instruction and move everything up by 5 bytes. So I end up with:

.text:00F74B42 mov     eax, dword_15A0C80
.text:00F74B47 test    eax, eax 
.text:00F74B49 jz      loc_xyz

Unfortunately when my program gets rebased to different virtual address, dword_15A0C80 is not correctly updated, instead, bytes at B47 - B4B are. I understand that dword_15A0C80's offset at 00F74B47 is stored somewhere so when .data segment gets a new virtual address it's updated. The question is where and how to search for it quickly using IDA for instance?

  • What do you mean by removing call instruction? Did you change it to nop? – Biswapriyo Aug 1 '18 at 19:46
  • @Biswapriyo as you can see I gained 5 bytes by removing "call sub_12D1130" which allowed me to use test eax, eax ( 2 bytes ) and jz loc_xyz ( 3 bytes ) – kurt hectic Aug 1 '18 at 20:39
1

I've come to answer my own question just as a future reference.

As I was not able to find such dword_15A0C80's reference in the relocation table, I made a simple crawler. It took into consideration all dword_15A0C80 occurrences and theirs last bytes that were not too far from each other which basically got me to one result pretty much right away. Note, that it was int16 occupying just 2 bytes, basically just an offset to subroutine which didn't seem significant in any way to me.

Thanks to freenode:##asm:Jester01 for pointing me the right direction.

  • Well done! Answering your own questions is actually encouraged here. – 0xC0000022L Aug 2 '18 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.